https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 23 Aug 2026 17:03:37 +0000 https://vulnerability.circl.lu/sighting/b269277a-a06f-4ba4-b2f1-6df3d52e88e9/export {"uuid": "b269277a-a06f-4ba4-b2f1-6df3d52e88e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-r5pq-6chh-j3xp", "type": "seen", "source": "https://gist.github.com/alon710/31e18879d387aa16512f599cadd2f7a1", "content": "# CVE-2026-63462: CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63462\n\n## Summary\nAn unauthenticated remote denial of service vulnerability exists in the Unleash feature management platform. By submitting a crafted JSON payload containing deeply nested structures to an OpenAPI-validated endpoint, an attacker can trigger uncontrolled recursion within the error formatting module. This leads to a call-stack exhaustion (RangeError: Maximum call stack size exceeded) inside the Node.js runtime, causing the service to crash immediately without recovery.\n\n## TL;DR\nUnauthenticated remote attackers can crash the Unleash server with a single ~10 KB nested JSON request, causing immediate and complete denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept available\n- **Impact**: Complete Denial of Service (DoS)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Unleash feature management server\n- **Unleash Server**: < 7.5.2 (Fixed in: `7.5.2`)\n- **Unleash Server**: >= 7.6.0, < 7.6.5 (Fixed in: `7.6.5`)\n- **Unleash Server**: >= 8.0.0, < 8.0.2 (Fixed in: `8.0.2`)\n\n## Mitigation\n\n- Upgrade Unleash platform to non-vulnerable release branches\n- Deploy Edge/WAF structural validation rules restricting JSON nesting depth\n- Configure process supervisors to automatically restart terminated Node.js processes\n\n**Remediation Steps:**\n1. Analyze package.json to identify instances of unleash-server falling within affected ranges (< 7.5.2, 7.6.0-7.6.4, 8.0.0-8.0.1)\n2. Update unleash-server dependency to v7.5.2, v7.6.5, or v8.0.2\n3. Rebuild and redeploy the containerized application\n4. Verify recovery mechanics by validating that systemd or Kubernetes restart policies are active\n\n## References\n\n- [GHSA Security Advisory](https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp)\n- [NVD CVE-2026-63462 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-63462)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-63462)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63462) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T12:31:57.180401Z"} {"uuid": "b269277a-a06f-4ba4-b2f1-6df3d52e88e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-r5pq-6chh-j3xp", "type": "seen", "source": "https://gist.github.com/alon710/31e18879d387aa16512f599cadd2f7a1", "content": "# CVE-2026-63462: CVE-2026-63462: Unauthenticated Stack Overflow Denial of Service in Unleash Server\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63462\n\n## Summary\nAn unauthenticated remote denial of service vulnerability exists in the Unleash feature management platform. By submitting a crafted JSON payload containing deeply nested structures to an OpenAPI-validated endpoint, an attacker can trigger uncontrolled recursion within the error formatting module. This leads to a call-stack exhaustion (RangeError: Maximum call stack size exceeded) inside the Node.js runtime, causing the service to crash immediately without recovery.\n\n## TL;DR\nUnauthenticated remote attackers can crash the Unleash server with a single ~10 KB nested JSON request, causing immediate and complete denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept available\n- **Impact**: Complete Denial of Service (DoS)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Unleash feature management server\n- **Unleash Server**: < 7.5.2 (Fixed in: `7.5.2`)\n- **Unleash Server**: >= 7.6.0, < 7.6.5 (Fixed in: `7.6.5`)\n- **Unleash Server**: >= 8.0.0, < 8.0.2 (Fixed in: `8.0.2`)\n\n## Mitigation\n\n- Upgrade Unleash platform to non-vulnerable release branches\n- Deploy Edge/WAF structural validation rules restricting JSON nesting depth\n- Configure process supervisors to automatically restart terminated Node.js processes\n\n**Remediation Steps:**\n1. Analyze package.json to identify instances of unleash-server falling within affected ranges (< 7.5.2, 7.6.0-7.6.4, 8.0.0-8.0.1)\n2. Update unleash-server dependency to v7.5.2, v7.6.5, or v8.0.2\n3. Rebuild and redeploy the containerized application\n4. Verify recovery mechanics by validating that systemd or Kubernetes restart policies are active\n\n## References\n\n- [GHSA Security Advisory](https://github.com/Unleash/unleash/security/advisories/GHSA-r5pq-6chh-j3xp)\n- [NVD CVE-2026-63462 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-63462)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-63462)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63462) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T12:31:57.180401Z"} https://vulnerability.circl.lu/sighting/b269277a-a06f-4ba4-b2f1-6df3d52e88e9/export Sat, 22 Aug 2026 12:31:57 +0000